This is the canonical Ironflow capability catalog and the exhaustive companion
to the SDK Comparison page. Its schema and exposure
boundaries are recorded in ADR 0065 after the implementation-evidence
audit of 2026-08-26. Where the comparison page answers “which SDK should I
use”, this matrix answers “exactly how is this capability exposed, and how sure
are we”.
Statuses: full (verified end to end), partial (works with a
documented limit), indirect (delivered through a different mechanism than
the named endpoint), missing (implemented on the server, no exposure
here), intentionally-excluded (a deliberate product or trust boundary),
not-applicable, unverified (support could not be proved from source —
treat as unknown, not as ❌). Tests/Docs record the audited state per
capability, and Classification names the dominant gap class for the row
(none means no gap).
The ironflow serve command wires NATS, PubSub, the NATS-backed secrets
manager, and an engine with a worker manager. Embedded servers can omit those
dependencies, which changes the routes that are actually mounted:
| Surface | Required dependency | Behavior when dependency is absent |
|---|
| PubSubService (ConnectRPC) | PubSub bridge and consumer manager | Service is not mounted. |
| Pub/sub publish (REST) | PubSub bridge | Route remains mounted and returns HTTP 503. |
| Pub/sub subscriptions (WebSocket) | PubSub manager | Upgrade succeeds; subscribe requests return PubSub not configured. |
| KV and config (REST and WebSocket watch) | NATS provider | Routes are not mounted. |
| Secrets (REST) | Secrets manager | Routes are not mounted. The standard CLI manager is NATS-backed. |
| WorkerService (ConnectRPC) | Engine with a worker manager | Service is not mounted. |
| Pull-worker polling (REST) | None for route mounting; engine for dispatch | Routes remain mounted. Engine-backed work is unavailable. |
The REST route manifest is the immutable SDK-generation catalog, so it still
lists optional REST routes that an embedded instance did not mount. The
ConnectRPC portion is built from that instance’s mounted-service snapshot.
Nine capability rows cover server push and live delivery. This is a capability
inventory, not a count of wire endpoints: Pub/sub subscription has both a
ConnectRPC stream and the generic WebSocket transport.
| Capability ID | Server transport |
|---|
exec-push-serve | Engine HTTP POST to the SDK-owned serve() endpoint |
exec-streaming-worker | WorkerService/Connect bidirectional stream |
proj-stream-events | ProjectionService/StreamProjectionEvents server stream |
proj-catchup | ProjectionService/WaitProjectionCatchupStream server stream |
pubsub-subscribe | PubSubService/Subscribe server stream and GET /ws |
pubsub-subscribe-bidi | Dedicated RPC is unimplemented; SDKs compose subscribe plus acknowledgments |
pubsub-cg-join | PubSubService/JoinConsumerGroup server stream |
kv-watch | GET /api/v1/kv/buckets/{bucket}/watch WebSocket upgrade |
config-watch | GET /api/v1/config/{name}/watch WebSocket upgrade |
The KV and config watch routes are present in sdk-parity.yaml and measured in
sdk-coverage.json. The generic GET /ws transport is deliberately skipped by
the endpoint ledger and represented by the pubsub-subscribe capability row.
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| event-emit | Emit/trigger event | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| event-emit-sync | Synchronous trigger | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| event-emit-batch | Batch trigger | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| event-list | List events | no | API key/JWT | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| event-names | List event names | no | API key/JWT | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| event-get | Get event by ID | no | API key/JWT | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| function-register | Register function | yes | API key | not-applicable | full | not-applicable | full | full | not-applicable | full | not-applicable | tested | documented | none |
| function-list | List functions | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| function-get | Get function detail | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| function-invoke | Direct invoke by ID | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| function-status | Enable/disable function | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| function-delete | Delete function | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| function-history | Function version history | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| function-at-version | Get function at version | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| function-rollback | Rollback function version | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| deployment-register | Register executable deployment | no | API key/JWT; functions:register | not-applicable | full | not-applicable | missing | missing | intentionally-excluded | full | not-applicable | tested | unverified | documentation gap |
| deployment-read | Read deployments and execution routing | no | API key/JWT; functions:read | not-applicable | full | not-applicable | missing | missing | intentionally-excluded | full | not-applicable | tested | unverified | documentation gap |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| run-list | List runs | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| run-get | Get run | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| run-steps | Run step list | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| run-cancel | Cancel run | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| run-resume | Resume run | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| run-pause | Pause run | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| run-paused-state | Get paused-run state | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| run-audit | Per-run audit trail | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| run-streams | Entity streams touched by run | no | API key/JWT | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| step-patch | Live patching of step output | no | none | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| step-inject-output | Inject step output into paused run | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| tt-run-state-at | Run state at timestamp | no | RPC-only | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| tt-run-timeline | Run mutation timeline | no | RPC-only | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| tt-step-output-at | Historical step output | no | RPC-only | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| step-run-memoized | step.run memoization | yes | Tier-1 SDKs only | not-applicable | not-applicable | full | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| step-sleep | Durable sleep/sleepUntil | yes | Tier-1 SDKs only | not-applicable | not-applicable | full | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| step-wait-for-event | waitForEvent yield | yes | Tier-1 SDKs only | not-applicable | not-applicable | full | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| step-invoke | step.invoke / invokeAsync | yes | Tier-1 SDKs only; ADR 0010 | not-applicable | not-applicable | full | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| step-parallel | Parallel branches | yes | Tier-1 SDKs only; client-side execution | not-applicable | not-applicable | indirect | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| step-compensate | Saga compensation | yes | Tier-1 SDKs only | not-applicable | not-applicable | full | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| exec-push-serve | Push mode serve() | yes | PushTimeout budget; optional HMAC signature | not-applicable | not-applicable | full | full | full | intentionally-excluded | indirect | not-applicable | tested | documented | none |
| exec-pull-worker | Pull worker protocol (register/heartbeat/poll/ack/update) | yes | REST routes always mount; engine required for dispatch; parity-manifest excluded | full | not-applicable | not-applicable | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| exec-workers-list | List connected workers | no | API key/JWT | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| exec-streaming-worker | Streaming worker (bidi) | yes | opt-in; Connect service mounts only when the engine has a worker manager | not-applicable | full | not-applicable | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| stream-append | Append entity event | no | optimistic concurrency | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| stream-read | Read stream events | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| stream-info | Stream info | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| stream-list | List entity streams | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| stream-history | Unified entity history | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| snapshot-create | Create snapshot | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| snapshot-get | Get snapshot | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| proj-register | Register projection (external runner) | yes | worker-SDK surface | not-applicable | full | not-applicable | full | full | not-applicable | intentionally-excluded | not-applicable | tested | documented | none |
| proj-unregister | Unregister projection | yes | worker-SDK surface | not-applicable | full | not-applicable | full | full | not-applicable | intentionally-excluded | not-applicable | tested | documented | none |
| proj-runner-transport | Runner transport (poll/save-state/ack/rebuild-progress) | yes | RPC_SKIP transport plumbing | not-applicable | full | not-applicable | full | full | not-applicable | intentionally-excluded | not-applicable | tested | unverified | none |
| proj-stream-events | Stream projection events | yes | server-stream; Go delivers via polling instead | not-applicable | full | not-applicable | indirect | full | not-applicable | full | not-applicable | tested | documented | none |
| proj-get | Get projection | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| proj-list | List projections | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| proj-status | Projection status/lag | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| proj-partitions | Partition listing | no | API key/JWT; browser operator boundary | full | not-applicable | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| proj-rebuild | Rebuild projection | no | API key/JWT; browser operator boundary | not-applicable | full | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| proj-rebuild-status | Rebuild job status | no | API key/JWT; browser operator boundary | not-applicable | full | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| proj-rebuild-cancel | Cancel rebuild | no | API key/JWT; browser operator boundary | not-applicable | full | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| proj-pause | Pause projection | no | API key/JWT; browser operator boundary | not-applicable | full | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| proj-resume | Resume projection | no | API key/JWT; browser operator boundary | not-applicable | full | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| proj-delete | Delete projection | no | API key/JWT; browser operator boundary | full | not-applicable | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| proj-sql-create | Create managed SQL projection | no | Go uses raw SQL; browser operator boundary | not-applicable | full | not-applicable | intentionally-excluded | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| proj-sql-query | Query SQL projection | no | API key/JWT | not-applicable | full | not-applicable | intentionally-excluded | full | full | full | not-applicable | tested | documented | none |
| proj-catchup | Wait for projection catchup | no | #473; stream variant exists | not-applicable | full | full | full | full | full | full | not-applicable | tested | documented | none |
| proj-catchup-batch | Batch catchup wait | no | API key/JWT; browser operator boundary | not-applicable | full | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| proj-wait-for-event | Wait for event applied | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| worker-projection-managed | Managed (pure reducer) projection handler | yes | Tier-1 SDKs only | not-applicable | not-applicable | full | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| worker-projection-external | External (side-effect) projection handler | yes | Tier-1 SDKs only | not-applicable | not-applicable | full | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| event-upcasters | Client-side upcaster registry | yes | runtime registration Tier-1 only; Browser and Python have no worker runtime; server dry-run separate | not-applicable | not-applicable | full | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| pubsub-publish | Publish to topic | no | NATS required; REST and Connect return 503 without a bridge | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| pubsub-subscribe | Subscribe replay+live | no | NATS required; Connect service is late-mounted; WebSocket subscribe errors without a manager; Go path near-untested | not-applicable | full | full | full | full | full | partial | not-applicable | partial | partial | SDK transport gap |
| pubsub-subscribe-bidi | Bidirectional subscribe | no | Dedicated Connect method is late-mounted but unimplemented; SDKs compose subscribe plus acknowledgments | not-applicable | partial | not-applicable | indirect | indirect | indirect | not-applicable | not-applicable | tested | documented | streaming transport gap |
| pubsub-cg-manage | Consumer group CRUD | no | NATS required; Connect service is late-mounted | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| pubsub-cg-join | Join consumer group | no | NATS required; Connect service is late-mounted | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| pubsub-topics | List topics | no | NATS required; Connect service is late-mounted; browser operator boundary | not-applicable | full | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| pubsub-topic-stats | Topic stats | no | NATS required; Connect service is late-mounted; browser operator boundary | not-applicable | full | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| kv-buckets | KV bucket CRUD | no | NATS required; REST routes are absent without a provider | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| kv-keys | KV key CRUD + list | no | NATS required; REST routes absent without a provider; Python exposes conditional headers as generated kwargs | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| kv-watch | Watch KV bucket | no | NATS required; REST watch route is absent without a provider | full | not-applicable | full | full | full | full | missing | not-applicable | tested | partial | streaming transport gap |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| config-read | Get/list config | no | NATS required; REST routes are absent without a provider | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| config-write | Set/patch/delete config | no | NATS required; REST routes are absent without a provider; server-only | full | not-applicable | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| config-watch | Watch config | no | NATS required; REST watch route is absent without a provider; browser uses a WebSocket topic instead | full | not-applicable | full | full | full | indirect | missing | not-applicable | tested | partial | streaming transport gap |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| secret-crud | Secrets CRUD (values write-only) | no | Secrets manager required; REST routes are absent without one; browser-excluded by design | full | not-applicable | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| schema-register | Register schema version | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| schema-read | List/get schemas | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| schema-delete | Delete schema version | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| schema-test-upcast | Dry-run upcaster chain | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| webhook-ingest | Inbound provider webhook | no | ifwh_ token waiver (ADR 0048); not SDK-callable | full | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | unverified | documented | intentional product boundary |
| webhook-source-crud | Webhook source management | no | snake_case codec (ADR 0023) | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| webhook-secret-ops | Rotate/expire secrets + ingest token | no | returns minted secrets to caller incl. browser | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| webhook-verify-test | Test verification config | no | request carries signing secret; dashboard diagnostic | not-applicable | full | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | documented | intentional product boundary |
| webhook-deliveries | Delivery log | no | API key/JWT | not-applicable | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| agent-tool-register | Register agent tool | yes | URL guard on callbacks | not-applicable | full | not-applicable | full | full | not-applicable | full | not-applicable | tested | documented | none |
| agent-tool-invoke | Invoke agent tool | yes | server-driven HMAC dispatch | not-applicable | full | not-applicable | indirect | indirect | not-applicable | full | not-applicable | tested | documented | none |
| agent-tool-unregister | Unregister agent tool | yes | worker-SDK surface | not-applicable | full | not-applicable | full | full | not-applicable | full | not-applicable | tested | documented | none |
| agent-tool-list | List agent tools | no | API key/JWT | not-applicable | full | not-applicable | full | full | not-applicable | full | not-applicable | tested | documented | none |
| agent-authoring | Agent authoring runtime (agent/defineTool/exposeMcp/llm/memory/spawn/approve) | yes | Tier-1 SDKs only | not-applicable | not-applicable | full | full | full | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | none |
| agent-client-invoke | Invoke agent + read memory (client composition) | no | InvokeFunctionSync for invoke; projection composition for readMemory | indirect | indirect | not-applicable | indirect | indirect | full | indirect | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| langgraph-checkpointer | LangGraph checkpointer (IronflowSaver) | no | checkpointer-only product scope; list() without thread_id throws; no endpoint drift gate | indirect | indirect | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | full | tested | documented | drift-detection gap |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| browser-offline-queue | Offline write queue (IndexedDB + multitab lock) | no | ADR 0053; browser-only | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | full | not-applicable | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| circuit-breaker-manage | Circuit breakers list/reset | no | CLI ironflow circuit-breaker is the supported route; ADR 0037 | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | documented | intentional product boundary |
| capacity-views | Capacity observability | no | read-only ops surface | full | not-applicable | not-applicable | intentionally-excluded | missing | intentionally-excluded | full | not-applicable | partial | unverified | intentional product boundary |
| debounce-manage | Debounce list/cancel | no | ops surface | full | not-applicable | not-applicable | intentionally-excluded | missing | intentionally-excluded | full | not-applicable | partial | unverified | intentional product boundary |
| outbox-dlq | Outbox DLQ list/requeue/discard | no | CLI ironflow outbox dlq is the supported route | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | documented | intentional product boundary |
| flow-edges | Flow map edges (emit/stream/topic/invoke/wait/webhook) | no | dashboard surface (#1262) | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | unverified | intentional product boundary |
| sql-execute | Raw SQL query | no | API key/JWT | not-applicable | full | not-applicable | full | intentionally-excluded | missing | full | not-applicable | tested | documented | none |
| audit-env-wide | Environment-wide audit | no | runs:read RBAC | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| audit-export | Filtered Audit Log JSONL export | no | runs:read RBAC; dashboard download and direct HTTP stream | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | intentionally-excluded | not-applicable | tested | documented | intentional product boundary |
| auth-audit | Authentication and authorization audit | no | runs:read RBAC; generated Python only | not-applicable | full | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| project-crud | Project CRUD | no | server-side surface | full | not-applicable | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | none |
| env-crud | Environment CRUD | no | EnvironmentService mounted; hand-written SDK methods remain REST-backed per ADR 0065 | full | full | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | none |
| env-rotate-apikey | Rotate environment API key | no | rotates by key id over REST (apikey-rotate’s route); compatibility RPC rejects ambiguous multi-key admin rotation | indirect | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| apikey-crud | API key CRUD | no | ifkey_/ifplatform_ prefixes | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| apikey-rotate | Rotate API key | no | minted secret returned to caller | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| apikey-roles | Replace key roles | no | admin RBAC; generated Python only | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | unverified | intentional product boundary |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| org-crud | Organization CRUD | no | RBAC + IsPlatform; tenant POST /orgs returns 403 | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| org-export | NDJSON customer-data export | no | authenticated administrators; no SDK wrapper; per-node single-flight (#774) | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | intentionally-excluded | not-applicable | unverified | documented | intentional product boundary |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| role-crud | Role CRUD | no | admin RBAC | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| role-policy-attach | Role-policy binding | no | admin RBAC | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| policy-crud | CEL policy CRUD | no | admin RBAC; mutations bump policy epoch (#793) | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| policy-dry-run | Dry-run policy | no | admin RBAC; generated Python only | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | unverified | intentional product boundary |
| policy-versions | Policy versions + rollback | no | admin RBAC; generated Python only | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | unverified | intentional product boundary |
| policy-templates | Policy templates list + install | no | admin RBAC; generated Python only | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | unverified | intentional product boundary |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| user-crud | User CRUD | no | server-only | full | not-applicable | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| user-password | Change user password | no | self-only authenticated route; server-only browser boundary | full | not-applicable | not-applicable | full | full | intentionally-excluded | full | not-applicable | tested | documented | intentional product boundary |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| tenant-provision | Provision tenant | no | admin RBAC | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| tenant-list | List tenants | no | admin RBAC | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| platform-auth | Platform login + bootstrap | no | login public; bootstrap needs tenant admin key | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | unverified | intentional product boundary |
| platform-admin | Platform users/roles/policies/tenants/audit | no | RequirePlatform(); ifplatform_ key | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | unverified | intentional product boundary |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| auth-dashboard-session | Dashboard login/validate/desktop-session | no | excluded from SDK parity by design | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | intentionally-excluded | not-applicable | unverified | unverified | intentional product boundary |
| ID | Capability | Worker | Restrictions | REST | ConnectRPC | Other | Go | Node | Browser | Python | LangGraph | Tests | Docs | Classification |
|---|
| cluster-ops | Cluster health + rotate-token | no | meta control plane; not tenant-callable | full | not-applicable | not-applicable | intentionally-excluded | intentionally-excluded | intentionally-excluded | full | not-applicable | partial | unverified | intentional product boundary |
| health-ready | Liveness/readiness | no | public paths | full | full | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| metrics-endpoint | Prometheus metrics | no | conditional on metrics enabled | full | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | unverified | unverified | none |
| capabilities-discovery | Server capability discovery | no | public; SDK transport detection | full | not-applicable | not-applicable | full | full | full | full | not-applicable | tested | documented | none |
| openapi-spec | OpenAPI 3.1 spec | no | REST-only contract; WS surfaces absent from artifact | full | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | unverified | documented | documentation gap |
| server-introspection | Overview/routes/debug/SPA/pprof | no | parity-excluded tooling surfaces | full | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | unverified | unverified | none |
| server-info | Server info | no | CLI ironflow server info; RPC_SKIP transport metadata; no SDK wrapper | not-applicable | full | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | not-applicable | tested | documented | intentional product boundary |